diff --git a/onnx-1.14.0.tar.gz b/onnx-1.15.0.tar.gz
similarity index 57%
rename from onnx-1.14.0.tar.gz
rename to onnx-1.15.0.tar.gz
index ba63fa69f2ad60fd3c19c8691f65f6802ff9c0f2..436e2e66ba2a360bd4dc8cd3edfc1119fc434c62 100644
Binary files a/onnx-1.14.0.tar.gz and b/onnx-1.15.0.tar.gz differ
diff --git a/onnx.spec b/onnx.spec
index aba95b8c6ec681ed67b53ccdd14e536bfd657b77..e0f1cf861cad287a388a98358da3a761df570b02 100644
--- a/onnx.spec
+++ b/onnx.spec
@@ -1,8 +1,8 @@
-%define anolis_release 3
+%define anolis_release 1
 
 %global protobuf_ver 3.20.2
 Name:           onnx
-Version:        1.14.0
+Version:        1.15.0
 Release:        %{anolis_release}%{?dist}
 Summary:        Open Neural Network Exchange
 License:        Apache
@@ -104,6 +104,9 @@ sed -i -e 's|/lib/|/%{_lib}/|g' %{buildroot}/%{_libdir}/cmake/ONNX/ONNXTargets-*
 
 
 %changelog
+* Mon May 06 2024 Chunmei Xu <xuchunmei@linux.alibaba.com> - 1.15.0-1
+- update to 1.15.0 to fix CVE-2024-27318
+
 * Wed Dec 27 2023 Chunmei Xu <xuchunmei@linux.alibaba.com> - 1.14.0-3
 - rebuild with protobuf-3.20.2